import type { HttpClient } from "../core/http.js";
import type { PayPrepareRequest, PayPrepareResponse, PaySignRequest, PaySignResponse, PayResultRequest, CreatePayGrantRequest, PayGrantResponse, PaySessionResponse, PaymentStatusResponse, UpdatePayGuardrailsRequest, PaySettingsResponse, OneclawResponse } from "../types.js";
/**
 * `1claw pay` — x402 micropayments under a human's authorization.
 *
 * The division of labour matters: the caller holds the network connection and
 * nothing else. It sends the vault the exact bytes a paywall served; the vault
 * decides what may be signed, what a person is shown, and what the daily ledger
 * says. Do not parse the 402 and send fields — the digest a person authorizes is
 * computed from the raw preimage, so anything reinterpreted first falls outside
 * the binding.
 */
export declare class PayResource {
    private readonly http;
    constructor(http: HttpClient);
    /**
     * Turn a 402 challenge into something signable.
     *
     * `challengeB64` is the response body (or `Payment-Required` header) exactly
     * as received. The response's `authorization` field says what happens next:
     * `allow`, `require_passkey`, `require_grant`, or `deny: <reason>`.
     */
    prepare(agentId: string, body: PayPrepareRequest): Promise<OneclawResponse<PayPrepareResponse>>;
    /**
     * Sign a prepared payment, returning the `X-PAYMENT` header value.
     *
     * Pass `passkeyToken` when `prepare` said `require_passkey`. The daily limit
     * is charged here, at signing time — a payment that is signed and then lost
     * still consumed authority, and only a vault-verified reconciliation returns
     * it, so reporting a failure afterwards will not.
     *
     * A `409` means the paywall's challenge window closed. Re-fetch the resource
     * for a fresh 402 and prepare again; re-preparing from the same bytes would
     * reproduce the same expired window, and many challenges carry a single-use
     * nonce.
     */
    sign(agentId: string, body: PaySignRequest, options?: {
        passkeyToken?: string;
    }): Promise<OneclawResponse<PaySignResponse>>;
    /**
     * Report what happened after presenting the payment.
     *
     * Best-effort and advisory: it moves the audit trail forward and releases
     * nothing. Omit `settled` when the outcome is genuinely unknown (a timeout
     * after the header was sent) rather than guessing `false`.
     */
    reportResult(agentId: string, paymentId: string, body: PayResultRequest): Promise<OneclawResponse<{
        recorded: string;
        limit_released: boolean;
    }>>;
    /** Status of a single payment. */
    get(agentId: string, paymentId: string): Promise<OneclawResponse<PaymentStatusResponse>>;
    /**
     * Read a pay session — what the authorize page renders and what a CLI polls.
     *
     * Requires the token of the human the session was raised for. Not an agent
     * token, and not merely someone else in the same org.
     */
    getSession(sessionId: string): Promise<OneclawResponse<PaySessionResponse>>;
    /**
     * Create a spending grant: one passkey touch covering payments up to a cap,
     * for a window.
     *
     * Human callers only, and `grantDigest` must be the digest the person
     * actually asserted over — it is compared against the terms being stored, so
     * a token obtained for a small, tightly scoped grant cannot create a large
     * open one.
     */
    createGrant(agentId: string, body: CreatePayGrantRequest, options: {
        passkeyToken: string;
    }): Promise<OneclawResponse<PayGrantResponse>>;
    /**
     * Set the agent's payment guardrails.
     *
     * Human callers only. These are the numbers every other pay decision is
     * measured against, so an agent cannot set them. Omitted fields are left
     * alone; values can be set but not currently cleared.
     */
    updateSettings(agentId: string, body: UpdatePayGuardrailsRequest): Promise<OneclawResponse<PaySettingsResponse>>;
    /** Revoke a grant before its window closes. */
    revokeGrant(grantId: string): Promise<OneclawResponse<{
        revoked: boolean;
    }>>;
}
//# sourceMappingURL=pay.d.ts.map